CVE-2025-23490

CVE-2025-23490 affects the WordPress Browser-Update-Notify plugin (versions

CVE-2025-23493

CVE-2025-23493 affects the WordPress Google Transliteration plugin (versions up to 1.7.2). The issue is a Reflected XSS caused by improper input neutralization during web page generation. Root cause: improper input handling; affected component: plugin’s rendering pathway. Impact per source: poten...

CVE-2025-23447

CVE-2025-23447 affects the WordPress plugin NotFound Smooth Dynamic Slider (Smooth Dynamic Slider) up to version 1.0. The issue is a Reflected XSS caused by improper input neutralization during web page generation. The CVSS v3.1 base score is 7.1 (HIGH). No explicit fix version is provided in the...

CVE-2025-23439

CVE-2025-23439 affects the WordPress plugin willshouse TinyMCE Extended Config, version

CVE-2025-23437

CVE-2025-23437 describes a reflected cross-site scripting vulnerability in the WordPress plugin ntp-header-images (NotFound) versions up to and including 1.2 . The issue stems from improper input neutralization during web page generation, enabling reflected XSS when processing input. Public docum...

CVE-2025-0475 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances...

PT-2025-9445

Name of the Vulnerable Software and Affected Versions devu Status Updater versions 1.9.2 and earlier Description The issue affects the devu Status Updater, allowing for Reflected XSS due to improper neutralization of input during web page generation. Recommendations For devu Status Updater versio...

PT-2025-9346

Name of the Vulnerable Software and Affected Versions azurecurve Floating Featured Image versions 2.2.0 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS in the azurecurve Floatin...

PT-2025-9414

Name of the Vulnerable Software and Affected Versions Site Launcher versions 0.9.4 and earlier Description The issue affects the Site Launcher, allowing for Reflected XSS due to improper neutralization of input during web page generation. Recommendations For versions 0.9.4 and earlier, update to ...

PT-2025-9401

Name of the Vulnerable Software and Affected Versions Tax Report for WooCommerce versions prior to 2.2 Description The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it allows for Reflected XS...

PT-2025-9439

Name of the Vulnerable Software and Affected Versions ehabstar User Role versions through 1.0 Description The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability, specifically Reflected XSS. Recommendations For...

PT-2025-9413

Name of the Vulnerable Software and Affected Versions WP-HR Manager: The Human Resources Plugin for WordPress versions n/a through 3.1.0 Description The issue affects the WP-HR Manager plugin, allowing Reflected XSS due to improper neutralization of input during web page generation. This can lead...

WordPress plugin NotFound ntp-header-images: cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin NotFound Twitter News Feed Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Maniac SEO has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Swift Calendar Online Appointment Scheduling – Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Mobigate has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin Mojo Under Construction has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress plugin...

WordPress plugin Contexto: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin Easy Automatic Newsletter Lite has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...